GRE over IPsec in Tunnel Mode same as IPsec over GRE?

[Talmoro]

Hello,

I'm currently studying for the ENCOR exam and came across the topic GRE over IPsec in Tunnel Mode / IPsec over GRE.
The OCG describes GRE over IPsec in tunnel mode as follows:

"In [GRE over IPsec] tunnel mode, the original packet is encapsulated in GRE, the entire GRE packet is encrypted by IPsec, and a new IPsec IP header is added. For this reason, GRE over IPsec in tunnel mode is commonly referred to as IPsec over GRE."

I always thought it was the other way around - on IPsec over GRE the outer header is GRE and not IPsec. So i tried to look around on the internet but I have found several contradictory sources in this regard.
Could someone help me elaborate which way its now correct?

Thank you!

[M02@rt37]

Hello @Talmoro 

IPsec over GRE: The IP packet is encrypted first with IPsec, and the resulting packet is then encapsulated in GRE. So GRE is the outermost protocol.

GRE over IPsec: The IP packet is first encapsulated in GRE, and then the GRE packet is encrypted and encapsulated by IPsec. IPsec is the outermost protocol.

https://harrymaq.medium.com/difference-between-ipsec-over-gre-gre-over-ipsec-b655b7baf9f1

[Talmoro]

The OCG states its the other way around. Also does this post:
https://ipwithease.com/gre-over-ipsec-vs-ipsec-over-gre/

Thats what confuses me.

[M02@rt37]

@Talmoro 

IPsec over GRE is more rare and less practical  so it means that ipsec is established first, and GRE traffic is sent over that encrypted upsec tunnel.

The OCG and your linked article confirm tha GRE over ipsec is the more typical and functional design...

[Joseph W. Doherty]

M02@rt37 's reference mentions fragmented packets, just once, and using transport mode just twice, recommending the latter.  Although transport mode is a valid suggestion, understandimg how to avoid fragmentation on any tunnel is very much worth knowing.  I recommend https://www.cisco.com/c/en/us/support/docs/ip/generic-routing-encapsulation-gre/25885-pmtud-ipfrag.html.